Monday, January 29th 2018
US Lawmakers to Pull Up Intel, ARM, Microsoft, and Amazon for Spectre Secrecy
In the wake of reports surrounding the secrecy and selective disclosure of information related to the Meltdown and Spectre vulnerabilities leading up to the eventual January 3 public release, US lawmakers are unhappy with leading tech firms Intel, Microsoft, ARM, Apple, and Amazon. The five companies, among a few unnamed others, are being pulled up by a house committee over allegations of selective access of vital information that caught many American companies off guard on the January 3rd. Barring a few tech giants, thousands of American companies were unaware, and hence unprepared for Meltdown and Spectre until January 3, and are now spending vast resources to overhaul their IT infrastructure at breakneck pace.
In letters such as this one, addressed to CEOs of big tech firms, lawmakers criticized the secrecy and selective disclosure of information to safeguard IT infrastructure, which has left thousands of American companies out in the lurch, having to spend vast amounts of money securing their infrastructure. "While we acknowledge that critical vulnerabilities such as these create challenging trade-offs between disclosure and secrecy, as premature disclosure may give malicious actors time to exploit the vulnerabilities before mitigations are developed and deployed, we believe that this situation has shown the need for additional scrutiny regarding multi-party coordinated vulnerability disclosures," they write.
Source:
Tech Republic
In letters such as this one, addressed to CEOs of big tech firms, lawmakers criticized the secrecy and selective disclosure of information to safeguard IT infrastructure, which has left thousands of American companies out in the lurch, having to spend vast amounts of money securing their infrastructure. "While we acknowledge that critical vulnerabilities such as these create challenging trade-offs between disclosure and secrecy, as premature disclosure may give malicious actors time to exploit the vulnerabilities before mitigations are developed and deployed, we believe that this situation has shown the need for additional scrutiny regarding multi-party coordinated vulnerability disclosures," they write.
35 Comments on US Lawmakers to Pull Up Intel, ARM, Microsoft, and Amazon for Spectre Secrecy
trog
Not releasing the information, I can understand. Dumping your stock and not working on a fix until much later on in the game is deplorable.
trog
I'm only curious why half a year wasn't enough to solve these vulnerabilities, specially Meltdown. It's mind-boggling really.
Also, I wonder how Intel had the insolence to release the Coffee Lake CPUs knowing full well that they were affected. If they had any consistence they should have postponed its release until software/hardware fixes have been deployed/enabled, so that the prospective customers knew what [performance losses] they were into.
"ask for the money back. Intel hahaha" ;)
Well Volkswagen had to buy back 288,000 Diesel cars just in the US.. Lets see how this one goes!
Thank you for watching! :-)
:laugh: best comment from Morten .
Intel was between rock and a hard place. They had to do something to counter Ryzen launch, even it if was half a year late. They just could not wait any longer, Coffee lake release was rushed even as it was.
So, who are you trying to BS here?
Embargo on Meltdown and Spectre was meant to end on January 9th.
For meltdown patches, Linux had a new kernel out on 3rd as you said, Microsoft released Windows 10 patches on 4th and Windows 7/8 got patches on 9th as initially planned.
Linux kernel community has been known to be extremely conservative when it comes to performance-degrading patches in the past decade. This KPTI which almost busted the performance of kernel call must have been a last resort and a hard choice as hell.
If you think that Intel didn't factor all of this in to their timeline, you are being naive. Intel could have fixed this well before coffee lake and had they done so, it would have negatively affected coffee lake sales as they would have had to acknowledge the flaw earlier. They may even have had to go back to the drawing board (at considerable expense) on that chip after the design was finished, causing them to either or go over budget or skip a generation . Shareholders would not have been pleased.
Their actions demonstrate that they only care about protecting their corporate interests rather than the consumer . . . Well most of the consumers . . . Their biggest clients were informed well in advance in a bid to keep their relationships in good standing. Hence their appearance in front of the house committee. Corrupt, greedy, unethical, conniving are just a few of the words that come to mind.
In the automotive industry, car makers are forced to issue recalls if a critical defect is found. The only reason that Intel won't be told to do this is because the industry is not as well regulated. I do hope, however, that they get buried in class actions for the next 20 years.
Sure, Intel could issue a recall, then what? Unlike VAG diesel cars and SUVs, you're not talking a few million worldwide, you're talking literal billions of devices.. devices that literally run the world as we speak. Even if Intel had been perfectly willing to swap every single affected chip (meaning literally all of em in use right now), they simply do not have the manufacturing capability to do so, nor do the partner OEMs and ODMs building devices and motherboards.
Evidently though, Intel and partners are most certainly not free of blame: they should have informed tier 2 partners (people like OVH, DigitalOcean, AV vendors and the like) a fair bit earlier in the pipeline, and they should NOT have released patches that needed to be pulled, certainly not as mandatory install ASAP security updates. At the same time though, their hand was being forced by other researchers being on the verge of INDEPENDENTLY discovering the same vulnerability. If other researchers can discover it cleanly and independently, then you can be certain that the evil hackers and attackers are at least as close to discovering it, if they're not shipping malware using it already. Result: the decision was made to ship the buggy patch and hope not too many people get bit by the bugs.
[Edit] Intel released the information about the security issue to (some) vendors back in June, meaning they likely knew about this well before.
Intel was aware of the issues in at least January 2017:SourceCoffee Lake was announced in Feb 2017: Source
Coffee lake was not released until October 2017: Source
Over a year to fix a critical security bug and still release another flawed processor in the mean-time? My original arguments still stand. It would have cost them a tonne of money, but they wouldn't be knowingly selling a product that is essentially broken.
PS: ARM was aware of the CPU faults just as much as Intel, for about as long and they happily announced the Cortex-A75 on 29 May 2017. These cores haven't even shipped in a real product yet (they will be in 2018) and ARM has not announced that they will be changing the core to mitigate.[/QUOTE]
Even if this turns out to be infeasible, think about where all of your e-mails, backups, etc. are stored.
It does also mention that Meltdown wasn't (independently) discovered until July.
That CVE assigning in February is interesting. Wiki has a bit of an error there, these were not assigned to Intel but assigned by Intel as CNA (CVE Numbering Authority). I am really curious about the background though, like who requested those.
Wiki article says it was discovered (or in reality, exploit found) in June by two different teams and again in December by third one. That third one was in the article you originally pointed to - when they went to Intel in December and said they discovered this, Intel responded that they already know (as it has been reported back in June).